Sigma detection rules, expert-reviewed

Possible ToolShell SharePoint Exploitation via ToolPane.aspx (via webserver)

This rule detects POST requests to the SharePoint ToolPane.aspx endpoint carrying the crafted parameters and SignOut.aspx referer used in the ToolShell exploit chain. ToolShell abused a set of SharePoint vulnerabilities to reach unauthenticated remote code execution on internet-facing servers. This request pattern is an early indicator of exploitation before any implant is dropped.

Possible GhostContainer Exchange Backdoor C2 Request via OWA (via webserver)

This rule detects HTTP requests to Exchange OWA carrying the custom control header and crafted VIEWSTATE prefix used by the GhostContainer backdoor. GhostContainer is an IIS/Exchange module backdoor deployed against high-value organizations in Asia. Operators tunnel commands through legitimate OWA endpoints which lets malicious traffic blend into normal Exchange usage and evade perimeter controls.

Malicious TBK DVR Command Injection via device.rsp Endpoint

This rule detects HTTP requests to the device.rsp endpoint carrying the ___S_O_S_T_R_E_A_MAX___ marker and a shell command which exploits CVE-2024-3721 on TBK DVR devices. A Mirai botnet variant uses this injection to download and run its ARM payload on vulnerable DVRs. The distinctive marker string in the request is a reliable exploitation signal.

Possible Apache Struts2 OGNL Content-Type Exploitation CVE-2017-5638 (via webserver)

This rule detects HTTP requests carrying an OGNL injection payload in the Content-Type header. The NKAbuse intrusion begins by exploiting the Struts2 vulnerability CVE-2017-5638, which smuggles an OGNL expression through a malformed Content-Type to run commands on the server, so this header content indicates attempted remote code execution against a public-facing web application.

Malicious HelloNet AppMgmt ServiceDll Persistence via Registry (via registry_set)

This rule detects modification of the AppMgmt service Parameters ServiceDll or ServiceMain registry values, a persistence mechanism used by the HelloNet campaign to load a malicious service DLL into svchost netsvcs. Hijacking a legitimate service DLL grants the attacker persistent SYSTEM-level execution while blending into normal service host activity.

Suspicious Service Masquerading as Thumbcache Loader via registry_set

This rule detects a Windows service registered as ThumbcacheService or backed by a TmcLoader binary, the persistence mechanism of the GoSerpent backdoor that injects into svchost. The thumbnail cache service name is a masquerade for the loader. A service with this benign sounding identity from an untrusted binary indicates backdoor persistence.

Suspicious UAC Bypass by Disabling Admin Consent Prompt via registry_set

This rule detects ConsentPromptBehaviorAdmin being set to zero, which disables the UAC elevation prompt for administrators. The WhatsApp VBScript campaign changes this to silently gain elevated execution before deploying RMM tooling. Lowering the admin consent behavior is a well-known privilege-escalation and defense-evasion move.

Suspicious COM Hijack via InprocServer32 Pointing to AppData DLL via registry_set

This rule detects a CLSID InprocServer32 default value being redirected to a DLL located under the user AppData directory. The Argamal RAT distributed through hentai games uses this COM hijack for persistence and stealthy code execution. A COM server pointing into a user-writable path is a classic hijack pattern and rarely legitimate.

Suspicious Service Masquerading as Google Update in ProgramData via registry_set

This rule detects a service ImagePath pointing to a Google Update named binary located under ProgramData\Google\Chrome instead of the legitimate Program Files Google Update directory. The pirated-media miner campaign installs a GoogleUpdateTaskMachineQC service from this wrong location to blend in. A signed-looking name in the wrong path is a strong persistence and masquerading signal.

Malicious Run Key Persistence for Masqueraded vcpktsvr Loader

This rule detects a Registry Run key value that points to vcpktsvr.exe inside a vcpacket folder under LOCALAPPDATA. The OceanLotus ZiChatBot campaign delivered via PyPI set a pkt-update autorun entry to relaunch this masqueraded loader at logon as reported by Kaspersky. A Run key referencing this fake service binary in a user directory indicates backdoor persistence.

Malicious Kernel Driver Service Registration for ProjectConfiguration Rootkit

This rule detects a service ImagePath registry value that references the ProjectConfiguration.sys driver. The HoneyMyte APT installed a kernel mode rootkit registered as a service under this driver name as documented by Kaspersky. Registration of this specific driver as a service indicates rootkit installation for persistence and stealth.

Malicious COM Hijacking via Twinapi CLSID InprocServer32 Registration

This rule detects registration of the twinapi.dll CLSID InprocServer32 under HKCU, a COM hijacking technique used by the ForumTroll APT to load the Dante spyware. By pointing a per-user CLSID to a malicious DLL, the attacker forces trusted processes to load their code whenever the hijacked COM object is instantiated. This provides stealthy persistence and execution without touching HKLM.

Suspicious GodRAT Persistence via Run MyStartupApp Value (via registry_set)

This rule detects creation of a MyStartupApp value under the current user Run key used by GodRAT for logon persistence. The RAT and its bundled browser-credential stealer rely on this autorun entry to survive reboots. The specific value name under Run distinguishes this activity from ordinary application startup entries.

Suspicious Security Support Provider Registration for Persistence

This rule detects modification of the LSA Security Packages values under the netsvcs or IKEEXT related keys used to register a malicious Security Support Provider. Lazarus used SSP registration during Operation SyncHole to gain persistence and load ThreatNeedle into LSA. Changes to the Security Packages list are rare outside of authentication package installs and warrant review.

Malicious Winlogon Windows Load Registry Persistence via registry_set

This rule detects modification of the Windows NT CurrentVersion Windows Load registry value which is executed at user logon and is a rarely used persistence location. GOFFEE set the Load value to run its payload each time an affected user signed in to targeted Russian organizations. Because legitimate software seldom uses this key any write to it is a high confidence persistence signal.